ced4568
507ac4c5d3
common/firewall/docker-tls/platform/lab-host/monitoring-agent/backup roles, orchestrated by site.yml with the ordering that matters (firewall/TLS land before the services that depend on them). Ansible Vault for secrets, no new tool introduced for this project's modest secret surface. Explicit dev/staging/production environment separation, no secrets committed (.gitignore covers vault plaintext, TLS keys, Terraform state, *.env). Validated: ansible-playbook --syntax-check clean.
34 lines
2.2 KiB
YAML
34 lines
2.2 KiB
YAML
# Production variables — referenced by every {{ }} placeholder in infra/docker/, infra/firewall/,
|
|
# and the roles below. Fill in the __PLACEHOLDER__ values once the real server exists
|
|
# (docs/PRODUCTION_DEPLOYMENT.md §1). Nothing here is a secret — real secrets live in
|
|
# infra/environments/production/*.env (gitignored) and Ansible Vault (see
|
|
# infra/ansible/group_vars/production.vault.yml.template), never in this plain-vars file.
|
|
|
|
env: production
|
|
academy_domain: __REPLACE_e.g._academy.rootnode.example__
|
|
|
|
# ── Network topology (Phase 4 §5 — placeholders until real hardware exists) ────────────────
|
|
platform_ip: __PLATFORM_VM_IP__
|
|
lab_host_ip: __LAB_HOST_VM_IP__
|
|
management_cidr: __YOUR_ADMIN_ACCESS_CIDR__ # e.g. a VPN/WireGuard subnet, never 0.0.0.0/0
|
|
proxmox_mgmt_cidr: __PROXMOX_HOST_MGMT_CIDR__
|
|
lab_subnet_range: "10.42.0.0/16" # matches NO_PROXY_CIDRS already used by the app
|
|
lab_gateway_port_range: "30000:32767" # see docs/PRODUCTION_NETWORK_SECURITY.md — Gateway-to-Lab reachability follow-up
|
|
|
|
# ── Storage (Phase 4 §4 — a decision framework, not a final layout; see docs/PHASE4_PRODUCTION_INFRASTRUCTURE.md §4)
|
|
rootnode_data_root: /srv/rootnode-data # expected to be a ZFS dataset mountpoint on the real host
|
|
|
|
# ── Registry / images (infra/docker/IMAGE_STRATEGY.md) ─────────────────────────────────────
|
|
registry: git.synthossystems.com
|
|
image_tag: __GIT_SHA_OR_RELEASE_TAG__
|
|
|
|
postgres_exporter_user: rootnode_exporter
|
|
|
|
# ── Observability (infra/monitoring/) ───────────────────────────────────────────────────────
|
|
prometheus_retention_days: 30
|
|
alertmanager_webhook_url: __REPLACE_e.g._uptime_kuma_or_ntfy_webhook__
|
|
|
|
# ── Backup (infra/backup/) ───────────────────────────────────────────────────────────────────
|
|
backup_retention_days: 30
|
|
backup_offsite_target: __REPLACE_e.g._Hetzner_Storage_Box_path_or_S3_bucket__
|